ChunkedMacVerification in Tink compares a calculated authentication tag with the supplied tag using a non‑constant‑time comparison. This timing discrepancy permits an attacker to measure response times and infer how many leading bytes of the tag match the correct value. By iterating this process byte by byte, the attacker can reconstruct the full correct tag, effectively breaking the integrity guarantee of the message and allowing authenticated forgery. The flaw is a classic timing side‑channel error (CWE‑208).

Google supplies the Tink cryptographic library for both Android and Java applications. Changes are limited to modules that perform the MAC verification step on chunked data streams. No explicit version numbers are stated in the advisory, so any release using the vulnerable ChunkedMacVerification implementation is potentially affected until patched.

The CVSS score of 8.2 ranks this as a high‑severity vulnerability. EPSS is reported as < 1%, implying that current exploitation visibility is low, and the vulnerability is not listed in CISA’s KEV database. Nonetheless, the attack is feasible from a remote context where an attacker can trigger verification requests and precisely measure timing – for example, in a mobile application that processes authenticated messages or in a server that accepts client‑supplied tags. The vulnerability’s impact is primarily on message authenticity and could be leveraged to perform unauthorized actions or data tampering.